Description

The docs state:

https://docs.docker.com/engine/security/seccomp/
name_to_handle_at | Sister syscall to open_by_handle_at. Already gated by CAP_DAC_READ_SEARCH.

But the profile does not include this syscall in the CAP_DAC_READ_SEARCH, forcing use of CAP_SYS_ADMIN if you need this syscall.

Consequently the syscall fails with EPERM (errno -1).

Reproduce

N/A

Expected behavior

It should be possible to enable this syscall with docker run --cap-add CAP_DAC_READ_SEARCH.

docker version

20.10.23 and e58c267d66cd9c8fc89c582047b22158c9d44db8.

docker info

N/A

Additional Info

No response